Subject: [kitten] Is there a difference between a one zero-length component princ and a no-component princ?

From: Nico Williams <[email-masked]>
Date: Mon, 10 Jun 2013 00:03:16 -0500

RFC4120 says Principal is an unconstrained sequence of components, and
components are strings of unconstrained length.

RFC1964 gives us the display (well, exported name token) syntax we're
used to: components separated by '/' then '@' then realm, with '@',
'/', '\' and some others backslash-quoted.

Near as I can see this means that "@EXAMPLE" could refer to
either/both of "zero-component principal in realm EXAMPLE" and "one
zero-length component principal in realm EXAMPLE".  This ambiguity
likely means that no on is using either form in production (though the
zero-component form is probably functional); this is convenient.

I have a use for having a new GSS-API name-type for representing
realms, and a corresponding use case for a GSS-API Kerberos mechanism
name-form for Kerberos realms.

I propose that we reserve the zero-component principal for naming
realms themselves.  I.e., I propose:

 - adding a new GSS generic name type: GSS_C_NT_ISSUER
 - adding a Kerberos representation/mapping of GSS_C_NT_ISSUER to
zero-component principal in the realm named by the imported string
 - the display, query, and exported name token forms for this would be
per-RFC1964: @REALM, with backslash quoting of the realm as
appropriate.

This will then be used for returning the realm (issuer) of an MN when
using GSS_Get_name_attribute() with a generic attribute for requesting
the issuer of a NAME (or, if used as a prefix attribute, of an
attribute of a NAME).

I had considered using krbtgt/REALM@REALM, but this felt
unsatisfactory.  @REALM is much more natural and happens to work and
almost certainly is available.

Comments welcomed.

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Mon, 10 Jun 2013 01:38:21 -0500

Also, for the generic issuer (realm, CA CN, ...) name syntax I think we
should use something like @domainname or @<free-from>.  It will not
generally be input by users, methinks, so it probably doesn't matter much,
and no common syntax other than DNS domainnames seems general enough.

---

From: Greg Hudson <[email-masked]>
Date: Mon, 10 Jun 2013 10:54:23 -0400

> zero-component form is probably functional); this is convenient.

MIT krb5 (all versions) will parse "@REALM" as one zero-length
component.  It looks like Heimdal will do the same.  I'm not sure if
this throws a wrench in your plans.

---

From: Nico Williams <[email-masked]>
Date: Mon, 10 Jun 2013 11:15:37 -0500

> this throws a wrench in your plans.

But won't both also display a single zero-length component name as @REALM?

I think it is exceedingly unlikely that either form is in use in
production, or testing even.